By adhering to CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) and adopting a layered defense strategy encompassing timely patching, network segmentation, and rigorous access controls, organizations can mitigate risks that Ghost and similar threat actors pose. The attacks, targeting sectors including healthcare, government, education, and manufacturing, leverage sophisticated techniques to disable security protocols, encrypt data, and demand ransoms in cryptocurrency. Microsoft has addressed a critical vulnerability in the Windows Disk Cleanup Tool (cleanmgr.exe) in the February 2025 Patch Tuesday security updates. Ghost actors rely heavily on Cobalt Strike Beacon, a penetration testing tool repurposed for malicious command-and-control (C2) operations. For exfiltration, limited data transfers to platforms like Mega.nz or Cobalt Strike Team Servers are observed, though Ghost typically threatens data leakage rather than executing large-scale exfiltration. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. These tools exploit Windows token impersonation to gain SYSTEM-level access, which is critical for deploying secondary payloads. Organizations should monitor for anomalous PowerShell activity, unauthorized use of tools like SharpZeroLogon, and unexpected network scans.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 20 Feb 2025 08:00:32 +0000